CVE-2014-3404

{"id": "CVE-2014-3404", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}]}, "published": "2014-10-10T01:55:09.150", "references": [{"url": "http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3404", "tags": ["Vendor Advisory"], "source": "ykramarz@cisco.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-310"}]}], "descriptions": [{"lang": "en", "value": "The Autonomic Networking Infrastructure (ANI) component in Cisco IOS XE does not properly validate certificates, which allows remote attackers to trigger acceptance of an invalid message via crafted messages, aka Bug ID CSCuq22677."}, {"lang": "es", "value": "El componente Autonomic Networking Infrastructure (ANI) en Cisco IOS XE no valida debidamente los certificados, lo que permite a atacantes remotos provocar la aceptaci\u00f3n de un mensaje inv\u00e1lido a trav\u00e9s de mensajes manipulados, tambi\u00e9n conocido como Bug ID CSCuq22677."}], "lastModified": "2014-10-10T17:52:02.397", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:cisco:ios_xe:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B7D95E8A-8F0B-44E5-B266-09E10BAAEC55"}], "operator": "OR"}]}], "sourceIdentifier": "ykramarz@cisco.com"}